0. Introduction

Did it on a macbook air as I am away from my Linux workstation at home
I will use some of my selfhosted services in examples, e.g. registry.bouvais.lu for docker registry and git.bouvais.lu for gitea.

1. Create env

First let's install everything that I will use using brew.

brew install docker

2. Images

FROM python:3.12-slim-bookworm AS base

LABEL org.opencontainers.image.title="tenant-base" \
      org.opencontainers.image.description="Hardened base image for tenant workspaces" \
      org.opencontainers.image.source="https://github.com/yourorg/yourrepo"

# System deps only — keep this layer stable so it's rarely rebuilt
RUN apt-get update && apt-get install -y --no-install-recommends \
        ca-certificates \
        curl \
        tini \
    && rm -rf /var/lib/apt/lists/*

# Non-root user, fixed UID/GID for predictable K8s securityContext
RUN groupadd --gid 1000 appuser \
    && useradd --uid 1000 --gid appuser --shell /bin/bash --create-home appuser

WORKDIR /home/appuser
USER appuser

ENTRYPOINT ["tini", "--"]